Splunk Search

Community Activity

Can I perform If-Then-Else logic within a search? I have a field that I want to report on, but in some of my events, that field is missing (null) and so I'd like to us... by maverick Splunk Employee in Splunk Search 04-14-2017 6 4	6	4
If function returning integers? This code snippet is being used to calculate a time into a normal time in the H.M format. The numbers are something l... by jordanb93 Explorer in Splunk Search 04-14-2017 0 2	0	2
I am not being able to calculate time difference between two event codes that are 1100 and 13, and also i want to exclude the logs if the interval between these two codes are less than 15 seconds Am trying below query but its not Working: index=* (sourcetype=WinEventLog:System OR sourcetype=WinEventLog:Security)... by himapate Explorer in Splunk Search 04-14-2017 0 2	0	2
How to find duration between multiple timestamps of different users? Hi all, The boundary of the logs: date and user. Total logs is more than 1000 logs. How should I list the date? I a... by limalbert Path Finder in Splunk Search 04-14-2017 0 3	0	3
return command - exit (or return known value) if no results found I have a search that is basically (there are actually 2 sub searches, but this makes it easier to understand): index... by thewer Explorer in Splunk Search 04-14-2017 2 5	2	5
Multiple values for table and values unique Hi guys, Can you help me ? I need to do a table like this New date available \| Origine date available 25/... by Abarny Path Finder in Splunk Search 04-14-2017 0 2	0	2
data is displayed by alphabetic order of the month name when using date_month to sort In 4.2.x, instead of June, July, August, September, the data listed as August, July, June, September. Data is display... by zliu Splunk Employee in Splunk Search 04-14-2017 1 4	1	4
how to search in default indexes (not only one) in one app without providing the index. Hello folks There is a way to configure which indexes belongs which splunk app. Is there also a way to configure in ... by zugji Path Finder in Splunk Search 04-14-2017 0 2	0	2
cron search in dashboard panel Hello, I am trying to create a search query, which i will later transfer to dashboard panel. This query is monitorin... by Fleshwriter Explorer in Splunk Search 04-13-2017 0 2	0	2
How to get the hostname from the logs? Hi, I have the syslogs coming from 4 consoles in to single path, how to extract the hostnames in inputs.conf file? ... by kiran331 Builder in Splunk Search 04-13-2017 0 3	0	3
Lookup on text file not working I wanted to use a file to use for usernames. For example, I want to know when the following people's account informat... by johnblakley Explorer in Splunk Search 04-13-2017 0 3	0	3
Calculate delta for range of time I'm fairly new to Splunk and its query language. I have this data that I'd like to search through and visualize in a ... by gauravnj1 Engager in Splunk Search 04-13-2017 0 5	0	5
How to get the previous savedsearch by a given savedsearch from the same user? I used the following query to get a list of savedsearches by a given user: index=_internal user="John Doe" \| table ... by splunkrocks2014 Communicator in Splunk Search 04-13-2017 0 11	0	11
Multiple lookups, with an OR I am looking to use lookups in an OR for a search. Roughly what I want to do is: <search> ((if IP_From_BAD_IP matche... by stakor Path Finder in Splunk Search 04-13-2017 0 2	0	2
How can I show the fields which have a specific value? I'm running the following - index=<claims_index> geico \| table *. This index has around 200 fields and I would like t... by ddrillic Ultra Champion in Splunk Search 04-13-2017 0 7	0	7
How to get different URIs in different fields using eval command? I have a URI field that contains call to different APIs like: http://mydomain.com/A/v1/* http://mydomina.com/B/v1/* ... by gibbs New Member in Splunk Search 04-13-2017 0 8	0	8
multiline log regex and field help I took a look at quite a few of the threads on here to solve my problem first, but mine seems to be a little more uni... by adepasquale Path Finder in Splunk Search 04-13-2017 0 3	0	3
How to group URLS based patterns? I have n of log files and i'm getting the proper result for each URL as of now, but im facing issue since the same ur... by jw44250 New Member in Splunk Search 04-13-2017 0 16	0	16
How to edit my search to find the average time duration between 2 events of same transaction id? Below is sample transaction id having multiple events of which 2 specific events are as follows: { Date_time: 22/0... by mayurkadam24 New Member in Splunk Search 04-13-2017 0 6	0	6
Start timer with transaction Hi guys, I need help cause I want start a timer when i have one values and end this same timer when this values ... by Abarny Path Finder in Splunk Search 04-13-2017 0 2	0	2
Timerange Setting In this I want to user to select the time range of maximum 6 month. It may be less than 6 month but can't be greater ... by vivek_manoj Explorer in Splunk Search 04-13-2017 0 1	0	1
Create a table that shows last 5 days and timestamps of found events each day Hello, I want to create a search that looks for events that contain a value for a field, and then show the timestamp... by ckunath Communicator in Splunk Search 04-13-2017 0 4	0	4
How to accommodate dashboard in a screen? Is there a way to automatically adjust the chart display properties according to screen size? I have developed few dashboards having multiple reports (Couple of pie charts ,and 2 trend line report) are part of d... by sk002873 New Member in Splunk Search 04-13-2017 0 6	0	6
pipeline as first character in search query Hi all, I would like to ask what is the meaning of using pipeline as first character in search query. I saw some vid... by kkkelvinkk New Member in Splunk Search 04-13-2017 0 5	0	5
Hi i want to join a field from log file and lookup table for eg in a.log file i have data as dept_id Name Leave_count 1 xx 9 2 ... by ujwalagangakoth New Member in Splunk Search 04-12-2017 0 2	0	2

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...

Splunk Search

Can I perform If-Then-Else logic within a search?

If function returning integers?

I am not being able to calculate time difference between two event codes that are 1100 and 13, and also i want to exclude the logs if the interval between these two codes are less than 15 seconds

How to find duration between multiple timestamps of different users?

return command - exit (or return known value) if no results found

Multiple values for table and values unique

data is displayed by alphabetic order of the month name when using date_month to sort

how to search in default indexes (not only one) in one app without providing the index.

cron search in dashboard panel

How to get the hostname from the logs?

Lookup on text file not working

Calculate delta for range of time

How to get the previous savedsearch by a given savedsearch from the same user?

Multiple lookups, with an OR

How can I show the fields which have a specific value?

How to get different URIs in different fields using eval command?

multiline log regex and field help

How to group URLS based patterns?

How to edit my search to find the average time duration between 2 events of same transaction id?

Start timer with transaction

Timerange Setting

Create a table that shows last 5 days and timestamps of found events each day

How to accommodate dashboard in a screen? Is there a way to automatically adjust the chart display properties according to screen size?

pipeline as first character in search query

Hi i want to join a field from log file and lookup table

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Quick connection discovery mode for forwarders

How to get an extract of threshold values set in s...

how to query OCI Audit logs from Datasafe

SPLUNK ES 8.2.3 Drill Down not appearing

Using Splunk to Analyze Web Traffic & Machine-Gene...

How can i export a list of all services in APM

Splunk Search

Join the Conversation